{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "import pandas as pd\n",
    "import numpy as np"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style>\n",
       "    .dataframe thead tr:only-child th {\n",
       "        text-align: right;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: left;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>Name</th>\n",
       "      <th>Identification</th>\n",
       "      <th>MachineType</th>\n",
       "      <th>ELFVersion</th>\n",
       "      <th>EntryPointAddress</th>\n",
       "      <th>ProgramHeaderOffset</th>\n",
       "      <th>SectionHeaderOffset</th>\n",
       "      <th>Flags</th>\n",
       "      <th>HeaderSize</th>\n",
       "      <th>SizeProgramHeader</th>\n",
       "      <th>...</th>\n",
       "      <th>R_386_16</th>\n",
       "      <th>R_386_PC8</th>\n",
       "      <th>R_386_8</th>\n",
       "      <th>R_386_PLT32</th>\n",
       "      <th>R_386_32PLT</th>\n",
       "      <th>R_386_32</th>\n",
       "      <th>R_386_GOTPC</th>\n",
       "      <th>R_386_SIZE32</th>\n",
       "      <th>GOT_SIZE</th>\n",
       "      <th>HASH_SIZE</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>1425</td>\n",
       "      <td>7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00</td>\n",
       "      <td>Advanced Micro Devices X86-64</td>\n",
       "      <td>1</td>\n",
       "      <td>400430</td>\n",
       "      <td>64</td>\n",
       "      <td>6664</td>\n",
       "      <td>0</td>\n",
       "      <td>64</td>\n",
       "      <td>56</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>48</td>\n",
       "      <td>28</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>hostname</td>\n",
       "      <td>7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00</td>\n",
       "      <td>Advanced Micro Devices X86-64</td>\n",
       "      <td>1</td>\n",
       "      <td>401480</td>\n",
       "      <td>64</td>\n",
       "      <td>12944</td>\n",
       "      <td>0</td>\n",
       "      <td>64</td>\n",
       "      <td>56</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>368</td>\n",
       "      <td>52</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>nautilus</td>\n",
       "      <td>7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00</td>\n",
       "      <td>Advanced Micro Devices X86-64</td>\n",
       "      <td>1</td>\n",
       "      <td>42bad0</td>\n",
       "      <td>64</td>\n",
       "      <td>1424416</td>\n",
       "      <td>0</td>\n",
       "      <td>64</td>\n",
       "      <td>56</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>15800</td>\n",
       "      <td>436</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>cups-browsed</td>\n",
       "      <td>7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00</td>\n",
       "      <td>Advanced Micro Devices X86-64</td>\n",
       "      <td>1</td>\n",
       "      <td>407280</td>\n",
       "      <td>64</td>\n",
       "      <td>146224</td>\n",
       "      <td>0</td>\n",
       "      <td>64</td>\n",
       "      <td>56</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>2288</td>\n",
       "      <td>172</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>sulogin</td>\n",
       "      <td>7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00</td>\n",
       "      <td>Advanced Micro Devices X86-64</td>\n",
       "      <td>1</td>\n",
       "      <td>4042a0</td>\n",
       "      <td>64</td>\n",
       "      <td>42296</td>\n",
       "      <td>0</td>\n",
       "      <td>64</td>\n",
       "      <td>56</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1008</td>\n",
       "      <td>80</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>5 rows × 342 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "           Name                                   Identification  \\\n",
       "0          1425  7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00   \n",
       "1      hostname  7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00   \n",
       "2      nautilus  7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00   \n",
       "3  cups-browsed  7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00   \n",
       "4       sulogin  7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00   \n",
       "\n",
       "                     MachineType  ELFVersion EntryPointAddress  \\\n",
       "0  Advanced Micro Devices X86-64           1            400430   \n",
       "1  Advanced Micro Devices X86-64           1            401480   \n",
       "2  Advanced Micro Devices X86-64           1            42bad0   \n",
       "3  Advanced Micro Devices X86-64           1            407280   \n",
       "4  Advanced Micro Devices X86-64           1            4042a0   \n",
       "\n",
       "   ProgramHeaderOffset  SectionHeaderOffset  Flags  HeaderSize  \\\n",
       "0                   64                 6664      0          64   \n",
       "1                   64                12944      0          64   \n",
       "2                   64              1424416      0          64   \n",
       "3                   64               146224      0          64   \n",
       "4                   64                42296      0          64   \n",
       "\n",
       "   SizeProgramHeader    ...      R_386_16  R_386_PC8  R_386_8  R_386_PLT32  \\\n",
       "0                 56    ...             0          0        0            0   \n",
       "1                 56    ...             0          0        0            0   \n",
       "2                 56    ...             0          0        0            0   \n",
       "3                 56    ...             0          0        0            0   \n",
       "4                 56    ...             0          0        0            0   \n",
       "\n",
       "  R_386_32PLT R_386_32  R_386_GOTPC  R_386_SIZE32  GOT_SIZE  HASH_SIZE  \n",
       "0           0        0            0             0        48         28  \n",
       "1           0        0            0             0       368         52  \n",
       "2           0        0            0             0     15800        436  \n",
       "3           0        0            0             0      2288        172  \n",
       "4           0        0            0             0      1008         80  \n",
       "\n",
       "[5 rows x 342 columns]"
      ]
     },
     "execution_count": 2,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "df_benign = pd.read_csv('re_benign_final.csv')\n",
    "df_benign.head()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "df_benign['label'] = 'B'"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style>\n",
       "    .dataframe thead tr:only-child th {\n",
       "        text-align: right;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: left;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>Name</th>\n",
       "      <th>Identification</th>\n",
       "      <th>MachineType</th>\n",
       "      <th>ELFVersion</th>\n",
       "      <th>EntryPointAddress</th>\n",
       "      <th>ProgramHeaderOffset</th>\n",
       "      <th>SectionHeaderOffset</th>\n",
       "      <th>Flags</th>\n",
       "      <th>HeaderSize</th>\n",
       "      <th>SizeProgramHeader</th>\n",
       "      <th>...</th>\n",
       "      <th>R_386_PC8</th>\n",
       "      <th>R_386_8</th>\n",
       "      <th>R_386_PLT32</th>\n",
       "      <th>R_386_32PLT</th>\n",
       "      <th>R_386_32</th>\n",
       "      <th>R_386_GOTPC</th>\n",
       "      <th>R_386_SIZE32</th>\n",
       "      <th>GOT_SIZE</th>\n",
       "      <th>HASH_SIZE</th>\n",
       "      <th>label</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>1425</td>\n",
       "      <td>7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00</td>\n",
       "      <td>Advanced Micro Devices X86-64</td>\n",
       "      <td>1</td>\n",
       "      <td>400430</td>\n",
       "      <td>64</td>\n",
       "      <td>6664</td>\n",
       "      <td>0</td>\n",
       "      <td>64</td>\n",
       "      <td>56</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>48</td>\n",
       "      <td>28</td>\n",
       "      <td>B</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>hostname</td>\n",
       "      <td>7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00</td>\n",
       "      <td>Advanced Micro Devices X86-64</td>\n",
       "      <td>1</td>\n",
       "      <td>401480</td>\n",
       "      <td>64</td>\n",
       "      <td>12944</td>\n",
       "      <td>0</td>\n",
       "      <td>64</td>\n",
       "      <td>56</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>368</td>\n",
       "      <td>52</td>\n",
       "      <td>B</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>nautilus</td>\n",
       "      <td>7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00</td>\n",
       "      <td>Advanced Micro Devices X86-64</td>\n",
       "      <td>1</td>\n",
       "      <td>42bad0</td>\n",
       "      <td>64</td>\n",
       "      <td>1424416</td>\n",
       "      <td>0</td>\n",
       "      <td>64</td>\n",
       "      <td>56</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>15800</td>\n",
       "      <td>436</td>\n",
       "      <td>B</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>cups-browsed</td>\n",
       "      <td>7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00</td>\n",
       "      <td>Advanced Micro Devices X86-64</td>\n",
       "      <td>1</td>\n",
       "      <td>407280</td>\n",
       "      <td>64</td>\n",
       "      <td>146224</td>\n",
       "      <td>0</td>\n",
       "      <td>64</td>\n",
       "      <td>56</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>2288</td>\n",
       "      <td>172</td>\n",
       "      <td>B</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>sulogin</td>\n",
       "      <td>7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00</td>\n",
       "      <td>Advanced Micro Devices X86-64</td>\n",
       "      <td>1</td>\n",
       "      <td>4042a0</td>\n",
       "      <td>64</td>\n",
       "      <td>42296</td>\n",
       "      <td>0</td>\n",
       "      <td>64</td>\n",
       "      <td>56</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1008</td>\n",
       "      <td>80</td>\n",
       "      <td>B</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>5 rows × 343 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "           Name                                   Identification  \\\n",
       "0          1425  7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00   \n",
       "1      hostname  7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00   \n",
       "2      nautilus  7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00   \n",
       "3  cups-browsed  7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00   \n",
       "4       sulogin  7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00   \n",
       "\n",
       "                     MachineType  ELFVersion EntryPointAddress  \\\n",
       "0  Advanced Micro Devices X86-64           1            400430   \n",
       "1  Advanced Micro Devices X86-64           1            401480   \n",
       "2  Advanced Micro Devices X86-64           1            42bad0   \n",
       "3  Advanced Micro Devices X86-64           1            407280   \n",
       "4  Advanced Micro Devices X86-64           1            4042a0   \n",
       "\n",
       "   ProgramHeaderOffset  SectionHeaderOffset  Flags  HeaderSize  \\\n",
       "0                   64                 6664      0          64   \n",
       "1                   64                12944      0          64   \n",
       "2                   64              1424416      0          64   \n",
       "3                   64               146224      0          64   \n",
       "4                   64                42296      0          64   \n",
       "\n",
       "   SizeProgramHeader  ...    R_386_PC8  R_386_8  R_386_PLT32  R_386_32PLT  \\\n",
       "0                 56  ...            0        0            0            0   \n",
       "1                 56  ...            0        0            0            0   \n",
       "2                 56  ...            0        0            0            0   \n",
       "3                 56  ...            0        0            0            0   \n",
       "4                 56  ...            0        0            0            0   \n",
       "\n",
       "  R_386_32 R_386_GOTPC  R_386_SIZE32  GOT_SIZE  HASH_SIZE  label  \n",
       "0        0           0             0        48         28      B  \n",
       "1        0           0             0       368         52      B  \n",
       "2        0           0             0     15800        436      B  \n",
       "3        0           0             0      2288        172      B  \n",
       "4        0           0             0      1008         80      B  \n",
       "\n",
       "[5 rows x 343 columns]"
      ]
     },
     "execution_count": 4,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "df_benign.head()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "df_benign.to_csv('benign.csv', index=False)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "/usr/local/lib/python2.7/dist-packages/IPython/core/interactiveshell.py:2718: DtypeWarning: Columns (7,42,43,136) have mixed types. Specify dtype option on import or set low_memory=False.\n",
      "  interactivity=interactivity, compiler=compiler, result=result)\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style>\n",
       "    .dataframe thead tr:only-child th {\n",
       "        text-align: right;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: left;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>Name</th>\n",
       "      <th>Identification</th>\n",
       "      <th>MachineType</th>\n",
       "      <th>ELFVersion</th>\n",
       "      <th>EntryPointAddress</th>\n",
       "      <th>ProgramHeaderOffset</th>\n",
       "      <th>SectionHeaderOffset</th>\n",
       "      <th>Flags</th>\n",
       "      <th>HeaderSize</th>\n",
       "      <th>SizeProgramHeader</th>\n",
       "      <th>...</th>\n",
       "      <th>R_386_16</th>\n",
       "      <th>R_386_PC8</th>\n",
       "      <th>R_386_8</th>\n",
       "      <th>R_386_PLT32</th>\n",
       "      <th>R_386_32PLT</th>\n",
       "      <th>R_386_32</th>\n",
       "      <th>R_386_GOTPC</th>\n",
       "      <th>R_386_SIZE32</th>\n",
       "      <th>GOT_SIZE</th>\n",
       "      <th>HASH_SIZE</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>800f8b125345784d532b29465b5c57d05287235d353553...</td>\n",
       "      <td>7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00</td>\n",
       "      <td>Intel 80386</td>\n",
       "      <td>1</td>\n",
       "      <td>8049130</td>\n",
       "      <td>52</td>\n",
       "      <td>39524</td>\n",
       "      <td>0</td>\n",
       "      <td>52</td>\n",
       "      <td>32</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>244</td>\n",
       "      <td>72</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>281491500be26d87280e9bfc201799dee35d00a70830dc...</td>\n",
       "      <td>7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00</td>\n",
       "      <td>Intel 80386</td>\n",
       "      <td>1</td>\n",
       "      <td>8048164</td>\n",
       "      <td>52</td>\n",
       "      <td>78028</td>\n",
       "      <td>0</td>\n",
       "      <td>52</td>\n",
       "      <td>32</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>99c3f6308185566bc036989b51f1bffb8c3b4a88106f41...</td>\n",
       "      <td>7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00</td>\n",
       "      <td>Intel 80386</td>\n",
       "      <td>1</td>\n",
       "      <td>8048130</td>\n",
       "      <td>52</td>\n",
       "      <td>2491188</td>\n",
       "      <td>0</td>\n",
       "      <td>52</td>\n",
       "      <td>32</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>132</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>f45833fc8629ed7a36294ad3ea5d97017d35af44281215...</td>\n",
       "      <td>7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00</td>\n",
       "      <td>Intel 80386</td>\n",
       "      <td>1</td>\n",
       "      <td>8048120</td>\n",
       "      <td>52</td>\n",
       "      <td>965476</td>\n",
       "      <td>0</td>\n",
       "      <td>52</td>\n",
       "      <td>32</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>104</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>877e20c0238e77912285a59505f1c2cb60ad12807ce488...</td>\n",
       "      <td>7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00</td>\n",
       "      <td>Intel 80386</td>\n",
       "      <td>1</td>\n",
       "      <td>8048120</td>\n",
       "      <td>52</td>\n",
       "      <td>965476</td>\n",
       "      <td>0</td>\n",
       "      <td>52</td>\n",
       "      <td>32</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>104</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>5 rows × 342 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "                                                Name  \\\n",
       "0  800f8b125345784d532b29465b5c57d05287235d353553...   \n",
       "1  281491500be26d87280e9bfc201799dee35d00a70830dc...   \n",
       "2  99c3f6308185566bc036989b51f1bffb8c3b4a88106f41...   \n",
       "3  f45833fc8629ed7a36294ad3ea5d97017d35af44281215...   \n",
       "4  877e20c0238e77912285a59505f1c2cb60ad12807ce488...   \n",
       "\n",
       "                                    Identification  MachineType  ELFVersion  \\\n",
       "0  7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00  Intel 80386           1   \n",
       "1  7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00  Intel 80386           1   \n",
       "2  7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00  Intel 80386           1   \n",
       "3  7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00  Intel 80386           1   \n",
       "4  7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00  Intel 80386           1   \n",
       "\n",
       "  EntryPointAddress  ProgramHeaderOffset  SectionHeaderOffset Flags  \\\n",
       "0           8049130                   52                39524     0   \n",
       "1           8048164                   52                78028     0   \n",
       "2           8048130                   52              2491188     0   \n",
       "3           8048120                   52               965476     0   \n",
       "4           8048120                   52               965476     0   \n",
       "\n",
       "   HeaderSize  SizeProgramHeader    ...      R_386_16  R_386_PC8  R_386_8  \\\n",
       "0          52                 32    ...             0          0        0   \n",
       "1          52                 32    ...             0          0        0   \n",
       "2          52                 32    ...             0          0        0   \n",
       "3          52                 32    ...             0          0        0   \n",
       "4          52                 32    ...             0          0        0   \n",
       "\n",
       "   R_386_PLT32 R_386_32PLT R_386_32  R_386_GOTPC  R_386_SIZE32  GOT_SIZE  \\\n",
       "0            0           0        0            0             0       244   \n",
       "1            0           0        0            0             0         0   \n",
       "2            0           0        0            0             0       132   \n",
       "3            0           0        0            0             0       104   \n",
       "4            0           0        0            0             0       104   \n",
       "\n",
       "   HASH_SIZE  \n",
       "0         72  \n",
       "1          0  \n",
       "2          0  \n",
       "3          0  \n",
       "4          0  \n",
       "\n",
       "[5 rows x 342 columns]"
      ]
     },
     "execution_count": 6,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "df_malware = pd.read_csv('re_malware_final.csv')\n",
    "df_malware.head()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "df_malware['label'] = 'M'"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style>\n",
       "    .dataframe thead tr:only-child th {\n",
       "        text-align: right;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: left;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>Name</th>\n",
       "      <th>Identification</th>\n",
       "      <th>MachineType</th>\n",
       "      <th>ELFVersion</th>\n",
       "      <th>EntryPointAddress</th>\n",
       "      <th>ProgramHeaderOffset</th>\n",
       "      <th>SectionHeaderOffset</th>\n",
       "      <th>Flags</th>\n",
       "      <th>HeaderSize</th>\n",
       "      <th>SizeProgramHeader</th>\n",
       "      <th>...</th>\n",
       "      <th>R_386_PC8</th>\n",
       "      <th>R_386_8</th>\n",
       "      <th>R_386_PLT32</th>\n",
       "      <th>R_386_32PLT</th>\n",
       "      <th>R_386_32</th>\n",
       "      <th>R_386_GOTPC</th>\n",
       "      <th>R_386_SIZE32</th>\n",
       "      <th>GOT_SIZE</th>\n",
       "      <th>HASH_SIZE</th>\n",
       "      <th>label</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>800f8b125345784d532b29465b5c57d05287235d353553...</td>\n",
       "      <td>7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00</td>\n",
       "      <td>Intel 80386</td>\n",
       "      <td>1</td>\n",
       "      <td>8049130</td>\n",
       "      <td>52</td>\n",
       "      <td>39524</td>\n",
       "      <td>0</td>\n",
       "      <td>52</td>\n",
       "      <td>32</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>244</td>\n",
       "      <td>72</td>\n",
       "      <td>M</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>281491500be26d87280e9bfc201799dee35d00a70830dc...</td>\n",
       "      <td>7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00</td>\n",
       "      <td>Intel 80386</td>\n",
       "      <td>1</td>\n",
       "      <td>8048164</td>\n",
       "      <td>52</td>\n",
       "      <td>78028</td>\n",
       "      <td>0</td>\n",
       "      <td>52</td>\n",
       "      <td>32</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>M</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>99c3f6308185566bc036989b51f1bffb8c3b4a88106f41...</td>\n",
       "      <td>7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00</td>\n",
       "      <td>Intel 80386</td>\n",
       "      <td>1</td>\n",
       "      <td>8048130</td>\n",
       "      <td>52</td>\n",
       "      <td>2491188</td>\n",
       "      <td>0</td>\n",
       "      <td>52</td>\n",
       "      <td>32</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>132</td>\n",
       "      <td>0</td>\n",
       "      <td>M</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>f45833fc8629ed7a36294ad3ea5d97017d35af44281215...</td>\n",
       "      <td>7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00</td>\n",
       "      <td>Intel 80386</td>\n",
       "      <td>1</td>\n",
       "      <td>8048120</td>\n",
       "      <td>52</td>\n",
       "      <td>965476</td>\n",
       "      <td>0</td>\n",
       "      <td>52</td>\n",
       "      <td>32</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>104</td>\n",
       "      <td>0</td>\n",
       "      <td>M</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>877e20c0238e77912285a59505f1c2cb60ad12807ce488...</td>\n",
       "      <td>7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00</td>\n",
       "      <td>Intel 80386</td>\n",
       "      <td>1</td>\n",
       "      <td>8048120</td>\n",
       "      <td>52</td>\n",
       "      <td>965476</td>\n",
       "      <td>0</td>\n",
       "      <td>52</td>\n",
       "      <td>32</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>104</td>\n",
       "      <td>0</td>\n",
       "      <td>M</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>5 rows × 343 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "                                                Name  \\\n",
       "0  800f8b125345784d532b29465b5c57d05287235d353553...   \n",
       "1  281491500be26d87280e9bfc201799dee35d00a70830dc...   \n",
       "2  99c3f6308185566bc036989b51f1bffb8c3b4a88106f41...   \n",
       "3  f45833fc8629ed7a36294ad3ea5d97017d35af44281215...   \n",
       "4  877e20c0238e77912285a59505f1c2cb60ad12807ce488...   \n",
       "\n",
       "                                    Identification  MachineType  ELFVersion  \\\n",
       "0  7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00  Intel 80386           1   \n",
       "1  7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00  Intel 80386           1   \n",
       "2  7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00  Intel 80386           1   \n",
       "3  7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00  Intel 80386           1   \n",
       "4  7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00  Intel 80386           1   \n",
       "\n",
       "  EntryPointAddress  ProgramHeaderOffset  SectionHeaderOffset Flags  \\\n",
       "0           8049130                   52                39524     0   \n",
       "1           8048164                   52                78028     0   \n",
       "2           8048130                   52              2491188     0   \n",
       "3           8048120                   52               965476     0   \n",
       "4           8048120                   52               965476     0   \n",
       "\n",
       "   HeaderSize  SizeProgramHeader  ...    R_386_PC8  R_386_8  R_386_PLT32  \\\n",
       "0          52                 32  ...            0        0            0   \n",
       "1          52                 32  ...            0        0            0   \n",
       "2          52                 32  ...            0        0            0   \n",
       "3          52                 32  ...            0        0            0   \n",
       "4          52                 32  ...            0        0            0   \n",
       "\n",
       "   R_386_32PLT R_386_32 R_386_GOTPC  R_386_SIZE32  GOT_SIZE  HASH_SIZE  label  \n",
       "0            0        0           0             0       244         72      M  \n",
       "1            0        0           0             0         0          0      M  \n",
       "2            0        0           0             0       132          0      M  \n",
       "3            0        0           0             0       104          0      M  \n",
       "4            0        0           0             0       104          0      M  \n",
       "\n",
       "[5 rows x 343 columns]"
      ]
     },
     "execution_count": 8,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "df_malware.head()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "df_malware.to_csv('malware.csv', index=False)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Prepare dataset"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "benign = pd.read_csv('benign.csv')\n",
    "malware = pd.read_csv('malware.csv')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "((2180, 343), (6945, 343))\n"
     ]
    }
   ],
   "source": [
    "print(benign.shape, malware.shape)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "dataset_initial = pd.concat([benign, malware], axis=0)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "(9125, 343)"
      ]
     },
     "execution_count": 15,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "dataset_initial.shape"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "(9125, 343)"
      ]
     },
     "execution_count": 16,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "dataset_shuffled = dataset_initial.sample(frac=1).reset_index(drop=True)\n",
    "dataset_shuffled.shape"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style>\n",
       "    .dataframe thead tr:only-child th {\n",
       "        text-align: right;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: left;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>Name</th>\n",
       "      <th>Identification</th>\n",
       "      <th>MachineType</th>\n",
       "      <th>ELFVersion</th>\n",
       "      <th>EntryPointAddress</th>\n",
       "      <th>ProgramHeaderOffset</th>\n",
       "      <th>SectionHeaderOffset</th>\n",
       "      <th>Flags</th>\n",
       "      <th>HeaderSize</th>\n",
       "      <th>SizeProgramHeader</th>\n",
       "      <th>...</th>\n",
       "      <th>R_386_PC8</th>\n",
       "      <th>R_386_8</th>\n",
       "      <th>R_386_PLT32</th>\n",
       "      <th>R_386_32PLT</th>\n",
       "      <th>R_386_32</th>\n",
       "      <th>R_386_GOTPC</th>\n",
       "      <th>R_386_SIZE32</th>\n",
       "      <th>GOT_SIZE</th>\n",
       "      <th>HASH_SIZE</th>\n",
       "      <th>label</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>1425</td>\n",
       "      <td>7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00</td>\n",
       "      <td>Advanced Micro Devices X86-64</td>\n",
       "      <td>1</td>\n",
       "      <td>400430</td>\n",
       "      <td>64</td>\n",
       "      <td>6664</td>\n",
       "      <td>0</td>\n",
       "      <td>64</td>\n",
       "      <td>56</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>48</td>\n",
       "      <td>28</td>\n",
       "      <td>B</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>hostname</td>\n",
       "      <td>7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00</td>\n",
       "      <td>Advanced Micro Devices X86-64</td>\n",
       "      <td>1</td>\n",
       "      <td>401480</td>\n",
       "      <td>64</td>\n",
       "      <td>12944</td>\n",
       "      <td>0</td>\n",
       "      <td>64</td>\n",
       "      <td>56</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>368</td>\n",
       "      <td>52</td>\n",
       "      <td>B</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>nautilus</td>\n",
       "      <td>7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00</td>\n",
       "      <td>Advanced Micro Devices X86-64</td>\n",
       "      <td>1</td>\n",
       "      <td>42bad0</td>\n",
       "      <td>64</td>\n",
       "      <td>1424416</td>\n",
       "      <td>0</td>\n",
       "      <td>64</td>\n",
       "      <td>56</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>15800</td>\n",
       "      <td>436</td>\n",
       "      <td>B</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>cups-browsed</td>\n",
       "      <td>7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00</td>\n",
       "      <td>Advanced Micro Devices X86-64</td>\n",
       "      <td>1</td>\n",
       "      <td>407280</td>\n",
       "      <td>64</td>\n",
       "      <td>146224</td>\n",
       "      <td>0</td>\n",
       "      <td>64</td>\n",
       "      <td>56</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>2288</td>\n",
       "      <td>172</td>\n",
       "      <td>B</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>sulogin</td>\n",
       "      <td>7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00</td>\n",
       "      <td>Advanced Micro Devices X86-64</td>\n",
       "      <td>1</td>\n",
       "      <td>4042a0</td>\n",
       "      <td>64</td>\n",
       "      <td>42296</td>\n",
       "      <td>0</td>\n",
       "      <td>64</td>\n",
       "      <td>56</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1008</td>\n",
       "      <td>80</td>\n",
       "      <td>B</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>5 rows × 343 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "           Name                                   Identification  \\\n",
       "0          1425  7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00   \n",
       "1      hostname  7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00   \n",
       "2      nautilus  7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00   \n",
       "3  cups-browsed  7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00   \n",
       "4       sulogin  7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00   \n",
       "\n",
       "                     MachineType  ELFVersion EntryPointAddress  \\\n",
       "0  Advanced Micro Devices X86-64           1            400430   \n",
       "1  Advanced Micro Devices X86-64           1            401480   \n",
       "2  Advanced Micro Devices X86-64           1            42bad0   \n",
       "3  Advanced Micro Devices X86-64           1            407280   \n",
       "4  Advanced Micro Devices X86-64           1            4042a0   \n",
       "\n",
       "   ProgramHeaderOffset  SectionHeaderOffset Flags  HeaderSize  \\\n",
       "0                   64                 6664     0          64   \n",
       "1                   64                12944     0          64   \n",
       "2                   64              1424416     0          64   \n",
       "3                   64               146224     0          64   \n",
       "4                   64                42296     0          64   \n",
       "\n",
       "   SizeProgramHeader  ...    R_386_PC8  R_386_8  R_386_PLT32  R_386_32PLT  \\\n",
       "0                 56  ...            0        0            0            0   \n",
       "1                 56  ...            0        0            0            0   \n",
       "2                 56  ...            0        0            0            0   \n",
       "3                 56  ...            0        0            0            0   \n",
       "4                 56  ...            0        0            0            0   \n",
       "\n",
       "  R_386_32 R_386_GOTPC  R_386_SIZE32  GOT_SIZE  HASH_SIZE  label  \n",
       "0        0           0             0        48         28      B  \n",
       "1        0           0             0       368         52      B  \n",
       "2        0           0             0     15800        436      B  \n",
       "3        0           0             0      2288        172      B  \n",
       "4        0           0             0      1008         80      B  \n",
       "\n",
       "[5 rows x 343 columns]"
      ]
     },
     "execution_count": 17,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "dataset_initial.head()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style>\n",
       "    .dataframe thead tr:only-child th {\n",
       "        text-align: right;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: left;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>Name</th>\n",
       "      <th>Identification</th>\n",
       "      <th>MachineType</th>\n",
       "      <th>ELFVersion</th>\n",
       "      <th>EntryPointAddress</th>\n",
       "      <th>ProgramHeaderOffset</th>\n",
       "      <th>SectionHeaderOffset</th>\n",
       "      <th>Flags</th>\n",
       "      <th>HeaderSize</th>\n",
       "      <th>SizeProgramHeader</th>\n",
       "      <th>...</th>\n",
       "      <th>R_386_PC8</th>\n",
       "      <th>R_386_8</th>\n",
       "      <th>R_386_PLT32</th>\n",
       "      <th>R_386_32PLT</th>\n",
       "      <th>R_386_32</th>\n",
       "      <th>R_386_GOTPC</th>\n",
       "      <th>R_386_SIZE32</th>\n",
       "      <th>GOT_SIZE</th>\n",
       "      <th>HASH_SIZE</th>\n",
       "      <th>label</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>42d7e2ac43d89f40d5e0debf3a4294fce4ee75ffae2db9...</td>\n",
       "      <td>7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00</td>\n",
       "      <td>Intel 80386</td>\n",
       "      <td>1</td>\n",
       "      <td>804e2a1</td>\n",
       "      <td>52</td>\n",
       "      <td>2345688</td>\n",
       "      <td>0</td>\n",
       "      <td>52</td>\n",
       "      <td>32</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1316</td>\n",
       "      <td>156</td>\n",
       "      <td>M</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>pstopnm</td>\n",
       "      <td>7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00</td>\n",
       "      <td>Advanced Micro Devices X86-64</td>\n",
       "      <td>1</td>\n",
       "      <td>401f70</td>\n",
       "      <td>64</td>\n",
       "      <td>16976</td>\n",
       "      <td>0</td>\n",
       "      <td>64</td>\n",
       "      <td>56</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>336</td>\n",
       "      <td>56</td>\n",
       "      <td>B</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>2a5c4b8a739b4c1c85f4866abb02a4699112d09d60ea41...</td>\n",
       "      <td>7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00</td>\n",
       "      <td>Intel 80386</td>\n",
       "      <td>1</td>\n",
       "      <td>8048164</td>\n",
       "      <td>52</td>\n",
       "      <td>95428</td>\n",
       "      <td>0</td>\n",
       "      <td>52</td>\n",
       "      <td>32</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>12</td>\n",
       "      <td>0</td>\n",
       "      <td>M</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>7fbce893dc6a51456fadcf86179ac0eff9026eb17b7f04...</td>\n",
       "      <td>7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00</td>\n",
       "      <td>Advanced Micro Devices X86-64</td>\n",
       "      <td>1</td>\n",
       "      <td>400503</td>\n",
       "      <td>64</td>\n",
       "      <td>721864</td>\n",
       "      <td>0</td>\n",
       "      <td>64</td>\n",
       "      <td>56</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>32</td>\n",
       "      <td>0</td>\n",
       "      <td>M</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>971062ea5bcbfd9998ff22acebc1a361a151fb1fb8d4e6...</td>\n",
       "      <td>7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00</td>\n",
       "      <td>Intel 80386</td>\n",
       "      <td>1</td>\n",
       "      <td>8048164</td>\n",
       "      <td>52</td>\n",
       "      <td>90292</td>\n",
       "      <td>0</td>\n",
       "      <td>52</td>\n",
       "      <td>32</td>\n",
       "      <td>...</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>12</td>\n",
       "      <td>0</td>\n",
       "      <td>M</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>5 rows × 343 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "                                                Name  \\\n",
       "0  42d7e2ac43d89f40d5e0debf3a4294fce4ee75ffae2db9...   \n",
       "1                                            pstopnm   \n",
       "2  2a5c4b8a739b4c1c85f4866abb02a4699112d09d60ea41...   \n",
       "3  7fbce893dc6a51456fadcf86179ac0eff9026eb17b7f04...   \n",
       "4  971062ea5bcbfd9998ff22acebc1a361a151fb1fb8d4e6...   \n",
       "\n",
       "                                    Identification  \\\n",
       "0  7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00   \n",
       "1  7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00   \n",
       "2  7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00   \n",
       "3  7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00   \n",
       "4  7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00   \n",
       "\n",
       "                     MachineType  ELFVersion EntryPointAddress  \\\n",
       "0                    Intel 80386           1           804e2a1   \n",
       "1  Advanced Micro Devices X86-64           1            401f70   \n",
       "2                    Intel 80386           1           8048164   \n",
       "3  Advanced Micro Devices X86-64           1            400503   \n",
       "4                    Intel 80386           1           8048164   \n",
       "\n",
       "   ProgramHeaderOffset  SectionHeaderOffset Flags  HeaderSize  \\\n",
       "0                   52              2345688     0          52   \n",
       "1                   64                16976     0          64   \n",
       "2                   52                95428     0          52   \n",
       "3                   64               721864     0          64   \n",
       "4                   52                90292     0          52   \n",
       "\n",
       "   SizeProgramHeader  ...    R_386_PC8  R_386_8  R_386_PLT32  R_386_32PLT  \\\n",
       "0                 32  ...            0        0            0            0   \n",
       "1                 56  ...            0        0            0            0   \n",
       "2                 32  ...            0        0            0            0   \n",
       "3                 56  ...            0        0            0            0   \n",
       "4                 32  ...            0        0            0            0   \n",
       "\n",
       "  R_386_32 R_386_GOTPC  R_386_SIZE32  GOT_SIZE  HASH_SIZE  label  \n",
       "0        0           0             0      1316        156      M  \n",
       "1        0           0             0       336         56      B  \n",
       "2        0           0             0        12          0      M  \n",
       "3        0           0             0        32          0      M  \n",
       "4        0           0             0        12          0      M  \n",
       "\n",
       "[5 rows x 343 columns]"
      ]
     },
     "execution_count": 18,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "dataset_shuffled.head()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "train_df = dataset_shuffled.iloc[:6388, :]\n",
    "test_df = dataset_shuffled.iloc[6388:, :]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 22,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "((6388, 343), (2737, 343))\n"
     ]
    }
   ],
   "source": [
    "print(train_df.shape, test_df.shape)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 25,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "M    4910\n",
       "B    1478\n",
       "Name: label, dtype: int64"
      ]
     },
     "execution_count": 25,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "train_df['label'].value_counts()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 26,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "M    2035\n",
       "B     702\n",
       "Name: label, dtype: int64"
      ]
     },
     "execution_count": 26,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "test_df['label'].value_counts()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 27,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "train_df.to_csv('train.csv', index=False)\n",
    "test_df.to_csv('test.csv', index=False)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 2",
   "language": "python",
   "name": "python2"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 2
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython2",
   "version": "2.7.12"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}
